<?php

namespace App\Http\Middleware;

use Closure;
use Log;

class XSSFilterMiddleware
{

    public function handle($request, Closure $next)
    {
        // 配置不执行过滤转换参数项，如 env 配置: XSS_EXCEPT=article_contents,html_contents
        $param_except_string = config('const.xss_filter_param_except');
        $param_except = [];
        if (!empty($param_except_string)) {
            $param_except = explode(',', $param_except_string);
        }
        $input = $request->except($param_except);
        array_walk_recursive($input, function (&$input) {
            // $input = strip_tags($input);  // 清除标签内容
            $input = htmlspecialchars($input, ENT_NOQUOTES, 'UTF-8', false); // 过滤转换预定符号
        });
        $request->merge($input);
        return $next($request);
    }
}
